Unified Write Filter

A Unified Write Filter is a filter driver that seals the drive in a non-write view and then keeps a differencing area in RAM of all the changes the user makes during the session. This area is known as the UWF overlay. This is a virtual storage area that looks at all the intended writes for the protected storage area. Instead of performing the write, it reads that disk sector from disk, then modifies it as the write was supposed to, and holds that change and caches it in memory (unless a page-file is in use; then it can make use of the page-file to extend the overlay area).

This is the biggest drawback of UWF. Typically, embedded devices do not have a preponderance of RAM installed (they are supposed to be cheaper than desktops, after all) and their storage is slow as well, so if the user does too much on the device, you run the risk of actually running out of RAM on the device.

To mitigate this, you can exclude areas of the storage from UWF protection (much like an antivirus). Administrators have to do this, and a restart of the device is required for them to take effect.

The same consideration is made for the Windows registry as the disk volume. And areas can be excluded there as well.

Applying updates to a UWF-protected volume requires some acrobatics. These are well documented at https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/service-uwf-protected-devices.